Electronic device protection systems and methods

ABSTRACT

Protection systems and methods for electronic devices including at least one communication line interface are disclosed. A switch connected to each interface and a working communication path in an electronic device is adapted for connection to a protection communication path and controllable to connect each interface to either the working communication path or the protection communication path. Inter-device messaging provides for switch control by a protection device connected to the protection communication path, monitoring of devices in a protection group, protection communication path monitoring, and automatic configuration of a protection group.

CROSS-REFERENCE TO RELATED APPLICATION

This application is related to and claims the benefit of U.S.Provisional Patent Application Ser. No. 60/566,481, filed on Apr. 29,2004, and entitled “ELECTRONIC DEVICE PROTECTION SYSTEMS AND METHODS”.The entire content of the provisional patent application, includingspecification and drawings, is incorporated into the present applicationby reference.

FIELD OF THE INVENTION

This invention relates generally to electronic devices and, inparticular, to protection of such devices.

BACKGROUND

In so-called redundant protection systems, multiple electronic devicesare provided in a protection group. For a 1:N protection scheme, forexample, the protection group includes one protection device whichprotects N working devices. A protection device is normallysubstantially identical to the working devices which it protects, suchthat all working device functions are protected.

When a protected working device fails, a protection device takes overall protected functions of the working device. In a common arrangementfor communication systems, for instance, communication lines which arenormally connected to ports or interfaces on the working device areswitched to the protection device. Such switching is traditionallyaccomplished using analog switching techniques and hardware such asrelays, on a line side of the interfaces. For 1:N protectionarrangements, multiple relays are required.

This approach may present a problem for multiple-interface deviceshaving high interface densities (e.g., 32 interfaces) because of thenumber of signals, the spacing of analog signal lines required to meetsafety and signal quality specifications, and in the case of 1:N or M:Narrangements, the number of relays required. Where the working andprotection devices are circuit cards intended for deployment in anequipment rack, for example, in which device interconnections areprovided on a backplane of the equipment rack, available physical spaceis limited, and may not be sufficient to accommodate appropriatelyspaced signal lines or multiple relays. Communication equipment such asswitches or routers, for example, may include many line cards, eachhaving multiple communication line interfaces.

In addition, relays tend to have high failure rates relative tointegrated circuit switching components. Relying on relays to performprotection switching may thus be undesirable, especially if no meansexist to verify that a switching operation is successful. As relays arealso less deterministic than digital switches, accurate timing forswitching operations is also difficult for relay-based protectionschemes.

The overall operation of conventional protection arrangements or theirsubsystems is not typically monitored. For example, connections betweena protection device and protected working devices are not checked forcorrect functioning before a protection switch is performed. If theseconnections are not functioning properly when a protection switchingoperation is required, then performing the switching operation will nothave the desired effect of bringing a protection device into operation.Therefore, these connections represent a potential point of failure inconventional protection arrangements. Verification that a switchingoperation was successful may also be desirable.

SUMMARY OF THE INVENTION

Embodiments of the invention enable protection switching formultiple-interface electronic devices using a protection communicationpath connecting devices in a protection group.

In a preferred embodiment, a switch which is connected betweencommunication line interfaces and a working communication path in aworking electronic device and also connected to a protectioncommunication path is controllable to connect the interfaces to eitherthe working communication path or the protection communication path.

According to one aspect of the invention, an electronic device isprovided, and includes at least one communication line interface, aworking communication path, and a switch connected to each interface andthe working communication path and for connection to a protectioncommunication path. The switch is controllable to connect each interfaceto either the working communication path or the protection communicationpath.

The electronic device may be a circuit card or an adapter card, forexample. In the latter case, the working communication path may beconnected to a service card or other device for processing interfacesignals received or to be transmitted through each interface.

In one embodiment, the switch is controllable to independently connecteach of a plurality of interfaces to either the working communicationpath or the protection communication path.

The switch may be controllable by either the electronic device itself ora protection electronic device connected to the protection communicationpath. The electronic device may include or be connected through theworking communication path to components configured to determine whetherthe protection device is connected to the protection path and operating,and to allow control of the switch by the protection device where theprotection device is present and operating. Otherwise, control of theswitch may be assumed by the electronic device or components. Switchingoperations for a switch controlled by the protection device may also berequested by the electronic device by sending a request to theprotection device over the protection communication path.

An electronic device protection system is also provided. The systemincludes a working electronic device having an interface, working devicecomponents, and a switch connected between the interface and the workingdevice components, a protection electronic device having protectiondevice components for protecting the working device the working deviceswitch and the protection device. The protection device is configured tocontrol the working device switch to connect the working deviceinterface to the protection device components through the protectioncommunication path or to the working device components.

The protection device may determine whether the working devicecomponents are operating, and to control the working device switch toconnect the working device interface to the protection device componentsthrough the protection communication path where the working devicecomponents are not operating. This determination may be made, forinstance, by periodically sending messages to the working device throughthe protection communication path and determining whether a response toeach message is received from the working device within a predeterminedresponse time interval.

The protection path itself may also be monitored by the protectiondevice by controlling the working device switch to loop back theprotection communication path and sending a test message to the workingdevice through the communication path.

In another embodiment, the working device is configured to determinewhether the protection device is operating and to control the workingdevice switch to connect the working device interface to the workingdevice components where the protection device is not operating.

Such a protection system may include multiple working devices andmultiple protection devices.

According to a further embodiment of the invention, the protectiondevice detects a further working device connected to the protectioncommunication path, and assumes control of a switch of the furtherworking device. For example, the protection device may be configured todetect the further working device by periodically sending messages toeach of a number of addressable locations on the protectioncommunication path at which a working device may be connected, anddetermining whether a message response is received from a working deviceconnected to the protection communication path at each of the locations.The addressable locations may be respectively associated with a sequenceof identifiers, in which case the protection device may be furtherconfigured to send a message to an addressable location associated withan identifier responsive to receiving a response to a message sent to anaddressable location associated with a preceding identifier in thesequence of identifiers. Slot numbers in an electronic equipment rackrepresent one example of such a sequence of identifiers.

A protection switching method is also provided for a protection groupcomprising working electronic devices and a protection electronicdevice. The working electronic devices and the protection electronicdevice include respective switches connected in a protectioncommunication path. The method includes sending a message from theprotection device to a working device on the protection communicationpath, determining whether a protection switching operation is to beperformed, based on the message, and controlling a switch in the workingdevice to connect working device signals to the protection devicethrough the protection communication path or to a working communicationpath in the working device where a protection switching operation is tobe performed.

The method may also include sending a response to the message from theworking device to the protection device. Where the message comprises anidentifier of the working device and control information, determiningmay involve determining whether the control information comprises aswitching command, and controlling the switch to perform the switchingcommand. The message may also include verification information, and ifso, determining may involve determining whether the message is validbased on the verification information. If a message is not valid, theswitch may be controlled to connect the working device signals to theworking communication path in the working device.

In another embodiment, the message sending operation includesperiodically sending messages to the working device, and determiningincludes detecting that a message has not been received at the workingdevice within a predetermined time interval. The switch may then becontrolled to connect the working device signals to the workingcommunication path in the working device responsive to the detecting.

According to yet another aspect of the invention, a method of monitoringa protection group including a protection electronic device connected toa protection communication path is provided. The method includes sendinga message to an addressable location selected from a sequence ofaddressable locations on the protection communication path at whichworking electronic devices may be connected and determining whether amessage response is received from a working device connected to theprotection communication path at the addressable location. Where aresponse is received, the method also includes adding the working deviceconnected to the protection communication path at the addressablelocation to the protection group, selecting a next address in thesequence of addressable locations, and repeating the steps of sendingand determining. Otherwise, the protection group is ended at a previousaddressable location in the sequence of addressable locations.

Other aspects and features of embodiments of the present invention willbecome apparent to those ordinarily skilled in the art upon review ofthe following description of the specific embodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Examples of embodiments of the invention will now be described ingreater detail with reference to the accompanying drawings, in which:

FIG. 1 is a block diagram of a system in accordance with an embodimentof the invention;

FIG. 2 is a block diagram of a system in accordance with a furtherembodiment of the invention;

FIG. 3 is a flow diagram of a method according to an embodiment of theinvention; and

FIG. 4 is a flow diagram of a method in accordance with anotherembodiment of the invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

FIG. 1 is a block diagram of a system in accordance with an embodimentof the invention. It should be appreciated that the system shown in FIG.1, as well as the contents of the other Figures, is presented solely forillustrative purposes, and that the invention is in no way limitedthereto.

The system of FIG. 1 includes a protection device 10 and working devices12, 14 which form a protection group. Although only one protectiondevice 10 and two working devices 12, 14 are explicitly shown in FIG. 1,embodiments of the invention may be implemented to provide for 1:1,generally referred to as 1+1, 1:N, or M:N protection arrangements. Aprotection communication path, sections of which are designated 16, 17in FIG. 1, connects the protection device 10 and the working devices 12,14 in a protection group. Each working device 12, 14 includes acommunication line interface 18, 22 and a switch 20, 24.

The protection device 10 is preferably substantially identical to theworking devices 12, 14 and provides protection for at least some of thefunctions of the working devices 12, 14. In the system of FIG. 1,working device functions supported by components on a communication lineside of the switches 20, 24 are not protected by the protection device10. The protection device 10 does not include a communication lineinterface and as such, functions of the interfaces 18, 22 are notprotected in the particular illustrative embodiment of the inventionshown in FIG. 1. It should be appreciated, however, that differentlevels of protection may be provided in other embodiments of theinvention by changing the location of the protection communication pathswitches 20, 24.

In a preferred embodiment, the protection device 10 protects all workingdevice functions associated with working device components on a deviceside of the switches 20, 24. The protection device 10 thereforepreferably includes at least components which are substantiallyidentical to the other working device components generally labelled inFIG. 1 on a device side of the switches 20, 24. As the protection device10 may support additional functions, such as monitoring the protectionpath 16, 17 and the working devices 12, 14 as described in furtherdetail below, the protection device 10 may also include furthercomponents or be configured somewhat differently than the workingdevices 12, 14. According to one embodiment, the protection device 10and the working devices 12, 14 incorporate identical hardware but areconfigured differently, using different operating software, for example.This type of embodiment allows a single hardware device to be configuredas a protection device or a working device.

Those skilled in the art will appreciate that the working devices 12, 14may be any of many different types of device. In one embodiment, theworking devices 12, 14 are line cards for communication equipment suchas a communication switch or router.

The interfaces 18, 22 enable the working devices 12, 14 to send,receive, or both send and receive communication signals over respectivecommunication lines. Such interfaces are commonly also referred to asports or lines, and references to interfaces herein should beinterpreted accordingly.

The type of the interfaces 18, 22 provided in the working devices 12, 14may be dependent upon such factors as the type of the working device 12,14, the type of communication line to which the working device 12, 14 isto be connected, and the communication protocols to be supported.Although each working device 12, 14 in a protection group preferablyincludes the same type of interface 18, 22, it should be appreciatedthat different working devices 12, 14 may include different types ofinterface. For example, a device or multiple devices in a protectiongroup may include interfaces compatible with such communicationstandards as T1 and OC3 or DS3. Other compatible interface types whichmay potentially be provided in a device or in different devices within aprotection group may be apparent to those skilled in the art.

In some embodiments, each working device 12, 14 includes multipleinterfaces 18, 22, preferably of the same type but possibly of differenttypes. According to one embodiment of the invention, each working device12, 14 includes one or more interfaces compatible with T1 or E1communication lines. A device may also include protected and unprotectedinterfaces.

The functions of the interfaces 18, 22 vary depending upon the type ofinterface. Each interface 18, 22 may perform additional functions beyondmerely providing a physical component such as a backplane connector forconnection to a communication line. These additional functionspreferably include at least a conversion function for converting betweenanalog signals on a line side of the interfaces 18, 22 and digitalsignals on a device side of the interfaces 18, 22. Such conversionenables protection switching to be accomplished using digital switches,which tend to be more reliable than relays and analog protectionswitching techniques used in conventional protection arrangements.

The switches 20, 24 provide multiple switching functions. Under normaloperating conditions, the switches 20, 24 connect the interfaces 18, 22to other components of the working device 12, 14 through a device orworking communication path. As described above, embodiments of theinvention may be implemented in conjunction with many different types ofworking devices 12, 14. Thus, the components of the working devices 12,14 and the functions performed thereby are dependent upon the type ofthe working devices 12, 14. Protection switching in accordance withembodiments of the invention is substantially independent of theparticular working device functions for which protection is provided.

When a working device failure is detected, by the protection device 10in one embodiment of the invention described in further detail below,the switcn 20, 24 in that working device 12, 14 connects the interface18, 22 of the device to the protection device 10 through the protectioncommunication path 16, 17.

The switch 20, being connected in the protection communication path 16,17 between the working device 14 and the protection device 10, alsoconnects the communication path sections 16, 17. Where the other workingdevice 14 fails, the interface 22 is thereby connected to the protectiondevice 10 through the working device 12.

In a “last” or terminal working device of a protection group, theworking device 14 in FIG. 1, a switch need not provide thisswitch-through function. The protection path 16, 17 ends at the workingdevice 14. However, in order to provide for protection path monitoring,the switch 24 may provide a loopback function, to effectively reflect ortransmit signals received on the protection path 16, 17 back toward theprotection device 10 on the protection path 16, 17.

Therefore, the switches 20 and 24 may be implemented using differentcomponents, as intermediate and terminal working devices on a protectioncommunication path may perform different protection switching functions.However, a dynamic protection arrangement may be provided by using acommon switch structure in all working devices 12, 14. For example, ifthe switch 24 in the working device 14 also supports the aboveswitch-through function, then further working devices may be added to aprotection group without requiring hardware changes to other workingdevices in the protection group. Similarly, support for the protectionpath loopback function in the switch 20 allows the working device 12, orany other intermediate working device, to loop back the protection pathand thus behave as a terminal working device in the event that a workingdevice is removed from the protection group. Thus, each working device12, 14 may include the same type of switch, which may be configured orcontrolled in different ways for intermediate and terminal workingdevices.

It should also be appreciated that the switches 20, 24 may providefurther switching functions in addition to protection switchingfunctions, such as communication line loopback and equipment loopback onthe device communication path, for instance.

As described above, the interfaces 18, 22 preferably provide forconversion between analog signals on a line side and digital signals ona device side thereof. This conversion enables implementation of theswitches 20, 24 as digital switches. In a dynamic protectionarrangement, configurable switching components such as FieldProgrammable Gate Arrays (FPGAs) may be preferred as the switches 20,24. Other suitable types of controllable and possibly configurableswitches will be apparent to those skilled in the art.

The protection communication path 16, 17 may include such components asphysical interfaces or connectors on the protection device 10 and eachworking device 12, 14, and a communication medium therebetween. Wherethe devices are circuit cards, for example, the protection communication10, 12, 14 and conductors on a backplane.

Since the working devices 12, 14 in a protection group share the sameprotection communication path 16, 17, the total number of conductors forprotection systems according to embodiments of the invention issubstantially reduced in comparison with conventional protectionsystems. Where analog and digital conversion is provided by theinterfaces 18, 22, physical space requirements are further reduced, asdigital signal lines do not require the same spacing as analog signallines. In addition, providing the switches 20, 24 on the working devices12, 14 also eliminates the need for external protection switchingcomponents which are typically provided on an equipment rack backplane.Data associated with multiple interfaces may also be multiplexed into asingle digital data stream on the protection communication path 16, 17,further reducing the number of signal lines used in a protection system.

In a preferred embodiment of the invention, the protection communicationpath includes a data path and a control path. The data path provides forconnection of the interfaces 18, 22 to the protection device 10, and thecontrol path provides for monitoring and control of a protection groupas described in further detail below. Separate data and control pathsallow monitoring and control operations to be performed by theprotection device 10, for example, even when the protection device is“active” or in a protection state, after a working device 12, 14 hasfailed and its interface 18, 22 is connected to the protection device10.

The system of FIG. 1 provides a protection switch architecture whichprotects the working devices 12, 14. The shared protection communicationpath 16, 17 makes the protection of devices with high interface or portdensities feasible even where physical space constraints exist.

According to a preferred embodiment, the protection device 10 acts as amaster device in the protection group and controls protection switching.The protection device 10 monitors the status of the protected workingdevices 12, 14, and initiates a protection switching operation when aworking device failure is detected. The operational health of theworking devices 12, 14 may be monitored, for example, using a controlmessaging scheme on the protection communication path 16, 17, asdescribed in further detail below. Interface signals for the interface18, 22 of a failed working device 12, 14 are switched from a normalworking communication path of the working device 12, 14 to theprotection communication path 16, 17, which is connected to theprotection device 10.

Protection switching may also be initiated, for example, in response toa request from a working device 12, 14. Other components, such as acontrol card for equipment in which a protection system is implemented,may be configured to detect working device faults or errors and requestprotection switching. Manual initiation of protection switching may alsobe supported, during system upgrades, for instance.

If the protection group is functional, as determined by the protectiondevice 10 through monitoring, the protection device 10 performs aprotection switching operation when monitored conditions or requestsfrom other devices or components indicate that such a switch isnecessary. As described in further detail below, the working devices 12,14 may also monitor the protection device 10, and automatically revertto a normal operating state after a protection switching operation if aproblem with the protection card 10 is detected. Although the switches20, 24 may be primarily controlled by the protection device 10 in someembodiments, a control override for the working devices 12, 14 may beprovided.

Protection group and protection path monitoring are described in furtherdetail below, with reference to a control messaging scheme.

FIG. 2 is a block diagram of a system in accordance with a furtherembodiment of the invention. As described above with reference to FIG.1, the invention is in no way limited to the particular embodiment shownin FIG. 2. Other embodiments may include further, fewer, or differentcomponents with different interconnections than explicitly shown in FIG.2.

The system of FIG. 2 is substantially similar to the system of FIG. 1,in that it includes a protection device 30 and a plurality of workingdevices 32, 34, 36 connected by a protection communication path havingsections 66, 68, 70. However, each of the devices 30, 32, 34, 36 in FIG.2 includes an adapter card 38, 42, 46, 50 and a service card 40, 44, 48,52. It will therefore be apparent that a device 30, 32, 34, 36 mayinclude multiple electronic devices. In one sense, each adapter card 38,42, 46, 50 may be considered an electronic device in the context of thepresent application.

Each of the working adapter cards 42, 46, 50 includes a line interfaceunit (LIU) 54, 58, 62 and an FPGA 56, 60, 64. The LIUs 54, 58, 62perform such functions as analog and digital conversion, clock recovery,and encoding and decoding, for example. In one embodiment, each adaptercard 42, 46, 50 includes 4 LIUs, each handling 8 communication lines, toprovide a 32-interface device. The FPGAs 56, 60, 64 are configurabledigital switching devices. The adapter cards 42, 46, 50 thereforerepresent one example implementation of the interfaces 18, 22 and theswitches 20, 24 of FIG. 1. Those skilled in the art will be familiarwith examples of LIUs and FPGAs and their operation.

The LIUs 54, 58, 62 are on an unprotected line side of the protectioncommunication path 66, 68, 70 and are therefore not protected in thesystem of FIG. 2. Thus, the protection adapter card 38 might not includean LIU. Alternatively, an LIU may be provided in the adapter card 38 butnot configured for operation when an adapter card is used in aprotection device. From the above description of FIG. 1, it will beapparent that the protection adapter card 38 need not necessarilyinclude the FPGA 52. However, the FPGA 52 may provide for switch-throughfunctionality to support addition of further protection devices (for anM:N protection arrangement) and possibly working devices in theprotection group, loopback of the protection communication path 66, 68,70 at the protection device end, and equipment loopback for the servicecard 40, for example. As described in further detail below, the FPGAsmay also perform messaging and control operations and provide protectiongroup status information to service cards.

In the system of FIG. 2, the working service cards 44, 48, 52 areprotected by a substantially identical service card 40. The servicecards 40, 44, 48, 52 may provide any of a multitude of differentfunctions for processing signals received or to be transmitted oncommunication lines through the adapter cards 42, 46, 50.

The overall operation of the system of FIG. 2 is substantially similarto that of FIG. 1. The protection device 30 preferably monitors theprotected working devices 32, 34, 36, and controls the FPGAs 56, 60, 64to perform protection switching operations.

FIG. 3 is a flow diagram of a method according to an embodiment of theinvention. When a protection group has been established, the group ismonitored at 80. As will be described in further detail below,monitoring at 80 may involve monitoring of the entire group by a device,such as a protection device, or monitoring of only some devices by otherdevices. In the latter case, working devices may monitor a protectiondevice, for example.

Where a protection switch is required, as determined at 82, such as inresponse to monitored conditions or an explicit request, a protectionswitching operation is performed at 84. Protection switching ispreferably controlled by a protection device, although working deviceoverrides may also be provided. Monitoring is resumed at 80 after aprotection switching operation is completed at 84, and the success orfailure of the protection switching operation can thus be determined.Monitoring also continues at 80 when protection switching is notrequired.

Those skilled in the art will appreciate that the invention is notrestricted to the method as shown in FIG. 3. Protection switchingmethods in accordance with embodiments of the invention may further ordifferent operations, performed in a different order than shown in FIG.3.

Further embodiments of the invention relate to protection switchmessaging between devices in a protection group, such as between amaster protection device and slave working devices. Inter-devicemessaging may increase the reliability of protection switchingoperations by providing for monitoring of protection communicationpaths, devices, and functions. A protection data path, a protectioncontrol path, operation of protection devices, and protection switchoversuccess or failure may be monitored or determined based on messagingschemes in accordance with embodiments of the invention. In conventionalprotection switching systems, interface status is unknown until aprotection switching operation is attempted.

In one embodiment, inter-device messaging is controlled primarily by amaster device, preferably a protection device, in a protection group.Messages are sent by the master device to slave devices, preferably theworking devices, when protection switching operations are to beperformed.

The messages may include destination information, control information,and a checksum or other verification information, which is used by adestination device to detect message corruption. In a control messagewhich causes a switching operation at a slave device, the controlinformation includes a command or command code, for example, which isprocessed at the slave device. In one embodiment, commands includeprotection switching commands to set or clear protection modes andcommands to set or clear protection communication path loopbacks.Protection switching commands control the activity state of a device. Inan active state, working device interfaces are connected to the workingdevice communication path, whereas in an inactive state or protectionmode, the working device interfaces are connected to a protection devicethrough the protection communication path.

Upon reception and verification of a control message from the masterdevice by a slave device, a response message indicating the identity ofthe slave device, response information, and a checksum for messagecorruption detection is preferably generated and sent to the masterdevice. The response information preferably includes a value or datapattern indicating that the message is a response message. Where aresponse message is acknowledging a command message, the command orcommand code from the command message being acknowledged may also beincluded in the response message.

Response messages provide a mechanism using which a master deviceverifies that a control message has been received by an intended slavedevice. A response message may also be used to indicate that a switchingoperation was successful, where the slave device is configured togenerate the response message after a commanded switching operation hasbeen performed, for instance.

In another embodiment, the master device verifies that the switchingoperation was successful by determining a state of a switch in the slavedevice. As those skilled in the art will appreciate, the state of theFPGAs 56, 60, 64 shown in FIG. 2 may be determined by the protectiondevice 10 by accessing FPGA registers. Other switch state detectionschemes may also be used, depending upon the type of switchesimplemented at protected working devices, for example.

Error or failure processing, such as re-trying a command message ordeclaring a failure of a working device, may be performed when aswitching operation is not successful or no response is received withina predetermined response time period.

In accordance with a preferred embodiment of the invention, the masterdevice also periodically sends messages across the protectioncommunication path to each slave device in a protection group. Suchmonitor messages do not invoke a protection switching function at aslave device, but provide for monitoring of the protection communicationpath and the protection group. Although monitor messages may have asimilar format to control messages, including an identity or address ofa destination device, control information, and a checksum, the controlinformation is preferably set to a predetermined value or data patternindicating that the message is a monitor message.

A response message, generated by a slave device when a monitor messageidentifying that slave device as the destination device is received,provides an indication to the master device that the slave device ispresent. A common response message format is preferably used forresponding to control messages and monitor messages. However, thecontent of response information may be different for control responsemessages and monitor response messages. For example, responseinformation in a control response message may indicate a particularcommand or command code being acknowledged.

Monitor response messages are preferably tracked at the master device,such as by using registers at the master device. In the event that aresponse message is not received from a destination slave device withina response time interval, then the master device may declare a slavedevice failure, and, for example, reconfigure the protection group toexclude the failed device.

Periodic monitor messages also allow slave devices to monitor the sanityof the master device, and thus determine whether protection switchingfunctions for subsequent command messages from the master device shouldbe executed or ignored. Command messages might be ignored, for example,after a predetermined number of corrupted or invalid monitor messagesare received from the master device. As described above, a checksum orother verification information may be included in monitor messages andused by a slave device to detect message corruption.

In one embodiment of the invention, devices in a protection group areassociated with indicators or addresses stored at the master deviceduring configuration of a protection group. The master deviceperiodically sends respective monitor messages to each slave device inthe protection group and determines whether a response message isreceived within a response time period.

According to a preferred embodiment, devices in a protection group maybe associated with any of a number of predetermined addresses. This typeof arrangement provides for expansion of a protection group subsequentto initial deployment. In an equipment rack, for example, cards may belocated within any of a number of slots which are addressable by slotnumber. A protection device may then send monitor messages to each slotnumber, in sequence, and await a response message from a device locatedin each slot. FIG. 4 is a flow diagram of a method according to such anembodiment.

At 92, a master device selects an address for a monitor message, andsends a monitor message to that address at 94. The selected address ispreferably the address of a first slave device, closest to the masterdevice, in the protection group. The master device then awaits aresponse message from a device at the selected address, and if aresponse message is detected at 96, the response message is processed at98, to update registers at the master device for instance. A nextaddress, such as a next slot, is selected at 100 and a monitor messageis sent to that address 94.

These operations are repeated until the master device detects a responsetimeout. If a response timeout is detected at 102, indicating that noresponse message was received within a response time interval, then acurrent monitoring cycle ends. Monitoring cycles are preferablyperformed periodically by a master device.

The method of FIG. 4 provides for protection group monitoring asdescribed above, by determining whether each slave device responds tothe master device in a timely fashion. In one embodiment, a monitormessage is generated at an interval of every 6 ms and sent to a selectedaddress, and the response time interval is 50 microseconds. Differentmonitor message and response time intervals may be used in otherembodiments. The response time interval preferably accounts for morethan a maximum trip delay between a master and a terminal slave device.

Automatic protection group detection is also enabled by the method ofFIG. 4. When a response message is received, the master device sends amonitor message to a next slave device, or a next location at which aslave device might be installed. The addition or removal of slavedevices may thus be detected by the master device. Protection groupconfiguration is then dynamic, and adjusts to any changes in installeddevices.

Consider, for example, an arrangement of devices in an equipment rack,including a master protection device in slot 4, and slave workingdevices in slots 5, 6, and 8, with the above monitor message interval of6 ms. At time t=0, the protection device sends a monitor message to slot5 and receives a response within a response time interval. Similarly, attime t=6 ms, the protection device sends a monitor message to slot 6 andreceives a response within the response time interval. At time t=12 ms,the protection device sends a monitor message to slot 7 but does notreceive any response within the response time interval. This marks theend of the protection communication path and thus the protection groupat slot 6.

If a working device is added to slot 7, then this may be detected duringa subsequent monitoring cycle to effectively extend the protection groupto include the devices in slots 7 and 8. The next monitoring cycle maybegin at the next monitor message interval, at t=18 ms in the aboveexample, so that the master device sends monitor messages substantiallycontinuously at periodic intervals. Monitoring cycles may insteadoperate with a different period than monitor messaging.

It should be appreciated that embodiments of the invention do notrequire that all devices implemented in a system belong to a protectiongroup. A communication switch, for example, may include both protecteddevices, in one or more protection groups, and unprotected devices. Inthe above example, if the working device installed in slot 7 is notconfigured for protection switching control, then it may simply ignorethe monitor message, and the protection group ends at slot 6.

In the event of a protection communication path failure or some otheroccurrence such as a card pull which changes a protection group, a slavedevice that was formerly part of a protection group detects that it hasnot received a monitor message within one or more monitor message cycletimes, illustratively within 500 ms. The device may then revert to anon-protection configuration, in which it assumes control of its ownswitching operations. If the device was in a protection state, then itsinterfaces are preferably connected to the working device communicationpath if possible. This auto-revert feature also ensures that a slavedevice reverts to normal operation if a master device fails. Uponprotection group restoration to include the device, the device isre-configured as a protected device within the protection group.

The protection communication path may also be used to transfer othertypes of messages than the control, monitor, and response messagesdescribed above. For example, where a switching operation may berequested by a slave device, request messages including an indication ofa requested switching operation or command may be sent by slave devicesto the master device. In another embodiment, the protectioncommunication path is used as a general purpose communications pathbetween multiple devices for relaying statistical information directlybetween devices, for instance.

Protection communication path loopback functionality at slave devicespermits further monitoring of a protection communication path, using BitError Rate Test (BERT) techniques, for example. After a switch in aterminal slave device at a far end of a protection communication pathhas been set to a protection communication path loopback state by themaster device, the integrity of the protection communication path can betested by sending a test signal or data pattern to the protectioncommunication path. Each device in the protection communication pathreceives the test signal, may perform some processing on the signal, andpasses the signal to a next device in the protection communicationsignal path. At the terminal device, the test signal is looped back andtravels in an opposite direction back to the master device.

The returned signal is then processed at the master device to determinewhether a number of errors introduced into the test signal duringtransmission along the protection communication path exceeds apredetermined threshold. The master device may also confirm whether thetest signal was processed by all of the slave devices in the protectiongroup, by accessing identifiers added to the test signal by each deviceas it passes the signal to the next device or a hop counter incrementedby each device, for instance. It should be appreciated, however, that insome embodiments, devices pass but might not process the test signal.The absence of a return signal within a predetermined time window isalso indicative of an error or failure at some point along theprotection communication path.

Those skilled in the art will appreciate that the operations describedabove may be supported in many different ways for different types ofdevice. For devices such as those shown in FIG. 2, for example,functions may be performed by the adapter cards, the service cards, ordivided between those components, depending upon the functions orcomponents to be monitored or controlled. If monitoring messages areused in making protection switching decisions, then monitoring responsemessage generation preferably involves at least some operationsperformed by protected equipment. In this case, receipt of a validmonitor response message by a master device indicates that protectedequipment is present and operating at a slave device. It should also beappreciated that any of these functions and operations may be supported,entirely or in part, by software executed by protection and workingdevices.

Many different implementations for the protection communication pathwill also be apparent. In one embodiment, a protection communicationpath uses 6 signal lines between neighbouring devices, with 2 linesbeing configured to carry an enable signal indicating the presence ofvalid data on the remaining 4 lines. The 4 lines then carry one nibbleof data at a time to transfer messages along the protectioncommunication path. The 2 enable lines may be used to respectivelyindicate the presence of valid data being transmitted in differentdirections between devices.

A further advantage of some embodiments of the invention is that aprotected working device is kept in synchronization with the status ofits interfaces in case an auto-revert occurs. Since protection switchingaccording to en-odiments of the invention is accomplished through aswitch on a working device, the working device has up to date connectioninformation, even while in an inactive or protected state. Where an FPGAis used as a switch, for example, the working device may also monitorprotection status in the FPGA to determine whether protection has beenrelinquished by the protection device. In the event of a switch back orauto-revert, a working device need only enable its working communicationpath interfaces, as all connections are already active.

What has been described is merely illustrative of the application ofprinciples of the invention. Other arrangements and methods can beimplemented by those skilled in the art without departing from thepresent invention.

For example, although described above primarily in the context ofequipment protection, the techniques disclosed herein may also be usedto provide per-interface protection, in conjunction with suitablyconfigured switches.

In addition, more than one protection device may be provided in aprotection group. One of the protection devices is preferably designatedas a master, and controls switching operations of both protectiondevices and working devices. The protection communication path for suchembodiments may include multiple paths, one per protection device forexample. Alternatively, multiplexing on a single protectioncommunication path may enable transfer of signals to more than oneprotection device.

More than one protection group may also be provided in electronicequipment. Where suitable switches are provided, a working device may bepart of more than one protection group.

The foregoing description relates primarily to protection switchingoperations performed when a protected device is to assume a protectionstate, in which a protection device effectively takes over operationsfrom the working device. It should be appreciated that the abovemonitoring and control operations may also be used to clear a protectionstate, whereby a failed working device resumes normal operations after afault or failure has been corrected.

1. An electronic device comprising: at least one communication lineinterface; a working communication path; and a switch connected to eachinterface and the working communication path and for connection to aprotection communication path, the switch being controllable to connecteach interface to either the working communication path or theprotection communication path.
 2. The electronic device of claim 1,wherein the electronic device comprises an adapter card, the workingcommunication path being for connection to a service card for processinginterface signals received or to be transmitted through each interface.3. The electronic device of claim 1, wherein the at least one interfacecomprises a plurality of interfaces, and wherein the switch iscontrollable to independently connect each of the plurality ofinterfaces to either the working communication path or the protectioncommunication path.
 4. The electronic device of claim 1, wherein theswitch is controllable by a protection electronic device connected tothe protection communication path.
 5. The electronic device of claim 4,wherein the switch is further controllable to connect the workingcommunication path to the protection communication path.
 6. Theelectronic device of claim 5, further comprising electronic devicecomponents connected to the working communication path the electronicdevice components comprising at least one of: a component configured todetermine whether the protection device is connected to the protectionpath and operating, to allow control of the switch by the protectiondevice where the protection device is present and operating, and toassume control of the switch where the protection device is not presentor is not operating; and a component configured to send to theprotection device over the protection communication path a request for aswitching operation of the switch.
 7. The electronic device of claim 1,the switch being for connection to protection communication pathsections and controllable to connect the protection communication pathsections.
 8. The electronic device of claim 1, wherein the switch isfurther controllable to loop back the protection communication path. 9.A protection system comprising at least one electronic device as definedin claim 1 and a protection device connected to the protectioncommunication path.
 10. An electronic device protection systemcomprising: a working electronic device having an interface, workingdevice components, and a switch connected between the interface and theworking device components; a protection electronic device havingprotection device components for protecting the working devicecomponents; and a protection communication path connecting the workingdevice switch and the protection device, wherein the protection deviceis configured to control the working device switch to connect theworking device interface to the protection device components through theprotection communication path or to the working device components. 11.The system of claim 10, wherein the protection device comprises a switchconnected between the protection communication path and the protectiondevice components and configured to control the working device switch.12. The system of claim 11, wherein the protection device is furtherconfigured to determine whether the working device components areoperating, and to control the working device switch to connect theworking device interface to the protection device components through theprotection communication path where the working device components arenot operating.
 13. The system of claim 12, wherein the protection deviceis configured to determine whether the working device components areoperating by periodically sending messages to the working device throughthe protection communication path and determining whether a response toeach message is received from the working device within a predeterminedresponse time interval.
 14. The system of claim 10, wherein the workingdevice switch is further controllable to loop back the protectioncommunication path, and wherein the protection device is furtherconfigured to monitor the protection communication path by controllingthe working device switch to loop back the protection communication pathand sending a test message to the working device through thecommunication path.
 15. The system of claim 10, wherein the workingdevice is configured to determine whether the protection device isoperating and to control the working device switch to connect theworking device interface to the working device components where theprotection device is not operating.
 16. The system of claim 10,comprising: a plurality of working electronic devices including theworking electronic device, each of the plurality of working deviceshaving an interface, working device components, and a switch connectedin the protection communication path and between the interface and theworking device components; and a plurality of protection devicesincluding the protection device, each of the plurality of protectiondevices having protection device components for protecting the workingdevice components and a switch connected between the protectioncommunication path and the protection device components.
 17. The systemof claim 10, wherein the protection device is further configured todetect a further working device connected to the protectioncommunication path by periodically sending messages to each of aplurality of addressable locations on the protection communication pathat which a working device may be connected and determining whether amessage response is received from a working device connected to theprotection communication path at each of the plurality of locations, andto assume control of a switch of the further working device.
 18. Thesystem of claim 17, wherein the plurality of addressable locations isrespectively associated with a sequence of identifiers, and wherein theprotection device is further configured to send a message to anaddressable location associated with an identifier responsive toreceiving a response to a message sent to an addressable locationassociated with a preceding identifier in the sequence of identifiers.19. Electronic equipment comprising the system of claim
 10. 20.Electronic equipment comprising a plurality of systems as defined inclaim 10, the plurality of systems defining respective protectiongroups.
 21. A protection switching method for a protection groupcomprising working electronic devices and a protection electronicdevice, the working electronic devices and the protection electronicdevice comprising respective switches connected in a protectioncommunication path, the method comprising: sending a message from theprotection device to a working device on the protection communicationpath; determining whether a protection switching operation is to beperformed, based on the message; and controlling a switch in the workingdevice to connect working device signals to the protection devicethrough the protection communication path or to a working communicationpath in the working device where a protection switching operation is tobe performed.
 22. The method of claim 21, further comprising: sending aresponse to the message from the working device to the protectiondevice, the message comprising an identifier of the working device andcontrol information, wherein determining comprises determining whetherthe control information comprises a switching command, and controllingcomprises controlling the switch to perform the switching command. 23.The method of claim 22, wherein the message further comprisesverification information, and wherein determining comprises determiningwhether the message is valid based on the verification information. 24.The method of claim 21, wherein sending comprises periodically sendingmessages to the working device, wherein determining comprises detectingthat a message has not been received at the working device within apredetermined time interval, and wherein controlling comprisescontrolling the switch to connect the working device signals to theworking communication path in the working device responsive to thedetecting.
 25. The method of claim 21, wherein controlling comprisescontrolling the switch to independently connect each of a plurality ofinterfaces in the working device to either the protection communicationpath or the working communication path.
 26. A method of monitoring aprotection group including a protection electronic device connected to aprotection communication path, the method comprising: sending a messageto an addressable location selected from a sequence of addressablelocations on the protection communication path at which workingelectronic devices may be connected; determining whether a messageresponse is received from a working device connected to the protectioncommunication path at the addressable location; where a response isreceived: adding the working device connected to the protectioncommunication path at the addressable location to the protection group;selecting a next address in the sequence of addressable locations; andrepeating the steps of sending and determining; and ending theprotection group at a previous addressable location in the sequence ofaddressable locations where a message response is not received from aworking device connected to the protection communication path at theaddressable location.